skybridge 0.0.0-dev.ba6476a → 0.0.0-dev.ba711bf

package/dist/commands/dev.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,CAAC,OAAO,OAAO,GAAI,SAAQ,OAAO;IACtC,MAAM,CAAU,WAAW,GAAG,0BAA0B,CAAC;IACzD,MAAM,CAAU,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,CAAU,KAAK,GAAG;QACtB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,2BAA2B;YACxC,GAAG,EAAE,CAAC;SACP,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YACpB,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,OAAO;YAC/C,OAAO,EAAE,IAAI;SACd,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAExC,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,oBAAoB,CAAC,IAAI,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,qEAAqE;YACrE,6DAA6D;QAC/D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,EACJ,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,kBAAkB,GAC1B,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,GAAG,GAAG;YACV,GAAG,OAAO,CAAC,GAAG;YACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;YACpB,qBAAqB,EAAE,MAAM,CAAC,WAAW,CAAC;SAC3C,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,WAAW,EAAE,CAAC;YAC9C,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7B,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,SAAS,CAC3B,IAAI,EACJ,WAAW,EACX,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CACb,CAAC;YAEF,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,aACnD,KAAC,MAAM,IAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,GAAI,EAExC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACpB,QAAQ,CAAC,CAAC,CAAC,CACV,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,yCAAgC,CACrD,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,8BAAmB,CACzB,EACD,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,MAAM,GAAQ,IACvD,EACN,MAAC,GAAG,IAAC,YAAY,EAAE,CAAC,aAClB,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,kDACM,GAAG,IAC1B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,GAAG,GAAQ,IACpD,EAEL,WAAW,CAAC,MAAM,KAAK,MAAM,IAAI,CAChC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,mEAAwD,EAC7D,KAAC,IAAI,IAAC,KAAK,EAAC,MAAM,EAAC,IAAI,+BAEhB,EACP,KAAC,IAAI,oBAAS,IACV,CACP,EACA,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,CACpC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,YAAE,WAAW,CAAC,OAAO,GAAQ,IAC7C,CACP,EACA,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,CACrC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,8BAAmB,EACxB,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,sDACU,GAAG,IAC9B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,IACF,CACP,EACA,WAAW,CAAC,MAAM,KAAK,OAAO,IAAI,CACjC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,MAAC,IAAI,IAAC,KAAK,EAAC,KAAK,qCACM,WAAW,CAAC,OAAO,IACnC,IACH,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,yCAAyC,IAAI,EAAE,GAAQ,IACtE,IACF,CACP,EAED,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,0CAA+B,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,SAAS,+CAEtB,IACH,EAEL,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,EAAC,IAAI,4DAEf,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACvB,MAAC,GAAG,IAEF,UAAU,EAAE,CAAC,EACb,aAAa,EAAC,QAAQ,aAEtB,MAAC,GAAG,eACF,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,KAAK,CAAC,IAAI,GAAQ,EACvC,MAAC,IAAI,IAAC,KAAK,EAAC,MAAM,kBACd,KAAK,CAAC,IAAI,OAAG,KAAK,CAAC,GAAG,QAAI,GAAG,IAC1B,IACH,EACN,KAAC,GAAG,IAAC,UAAU,EAAE,CAAC,YAChB,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,KAAK,CAAC,OAAO,GAAQ,GACpC,KAZD,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,CAa3C,CACP,CAAC,IACE,CACP,EACA,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,4BAEjB,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACzB,KAAC,GAAG,IAAkB,UAAU,EAAE,CAAC,YAChC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAC5B,8BACE,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,uBAAG,IAAI,IAAQ,EAClC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,OAAO,CAAC,IAAI,GAAQ,IACxC,CACJ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAC7B,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,OAAO,CAAC,IAAI,GAAQ,CACxC,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,cAAE,OAAO,CAAC,IAAI,GAAQ,CAC5B,IAVO,OAAO,CAAC,EAAE,CAWd,CACP,CAAC,IACE,CACP,IACG,CACP,CAAC;QACJ,CAAC,CAAC;QAEF,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAC,GAAG,KAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,uEAAuE;QACvE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,EAAE;YACtC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,kBAAkB,EAAE;iBACtB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC","sourcesContent":["import { Command, Flags } from \"@oclif/core\";\nimport { Box, render, Text } from \"ink\";\nimport { resolvePort } from \"../cli/detect-port.js\";\nimport { Header } from \"../cli/header.js\";\nimport { resolveViewsDir } from \"../cli/resolve-views-dir.js\";\nimport { startTunnelControlServer } from \"../cli/tunnel-control-server.js\";\nimport { useMessages } from \"../cli/use-messages.js\";\nimport { useNodemon } from \"../cli/use-nodemon.js\";\nimport { useOpenBrowser } from \"../cli/use-open-browser.js\";\nimport { useTunnel } from \"../cli/use-tunnel.js\";\nimport { useTypeScriptCheck } from \"../cli/use-typescript-check.js\";\nimport { scanAndWriteViewsDts } from \"../web/plugin/scan-views.js\";\n\nexport default class Dev extends Command {\n  static override description = \"Start development server\";\n  static override examples = [\"skybridge\"];\n  static override flags = {\n    port: Flags.integer({\n      char: \"p\",\n      description: \"Port to run the server on\",\n      min: 1,\n    }),\n    tunnel: Flags.boolean({\n      description: \"Open an Alpic tunnel for remote testing\",\n      default: false,\n    }),\n    open: Flags.boolean({\n      description: \"Open DevTools in the browser when the server is ready\",\n      default: process.env.SKYBRIDGE_OPEN !== \"false\",\n      allowNo: true,\n    }),\n    verbose: Flags.boolean({\n      char: \"v\",\n      description: \"Show tunnel logs\",\n      default: false,\n    }),\n  };\n\n  public async run(): Promise<void> {\n    const { flags } = await this.parse(Dev);\n\n    // Generate .skybridge/views.d.ts before render() spawns `tsc --noEmit\n    // --watch`. Vite's plugin config hook writes the same file when nodemon\n    // boots the server, but tsc starts in parallel — if .skybridge/ doesn't\n    // exist at tsc startup, its watcher never picks up the late-created file\n    // and the dev UI reports phantom TS errors forever.\n    const root = process.cwd();\n    try {\n      scanAndWriteViewsDts(root, await resolveViewsDir(root));\n    } catch {\n      // Best-effort: if the scan fails (e.g. broken vite config, duplicate\n      // view names) tsc may show phantom errors, but the dev server should\n      // still start so the developer can fix the underlying issue.\n    }\n\n    const { port, fallback, envWarning } = await resolvePort(flags.port);\n    if (envWarning) {\n      this.warn(envWarning);\n    }\n\n    const {\n      port: controlPort,\n      manager: tunnelManager,\n      close: closeTunnelControl,\n    } = await startTunnelControlServer(() => port);\n\n    const env = {\n      ...process.env,\n      __PORT: String(port),\n      __TUNNEL_CONTROL_PORT: String(controlPort),\n    };\n\n    const App = () => {\n      const tsErrors = useTypeScriptCheck();\n      const [messages, pushMessage] = useMessages();\n      useNodemon(env, pushMessage);\n      useOpenBrowser(port, flags.open);\n      const tunnelState = useTunnel(\n        port,\n        pushMessage,\n        flags.verbose,\n        flags.tunnel,\n      );\n\n      return (\n        <Box flexDirection=\"column\" padding={1} marginLeft={1}>\n          <Header version={this.config.version} />\n\n          <Box>\n            <Text>🏠{\"  \"}</Text>\n            {fallback ? (\n              <Text color=\"yellow\">3000 in use, running on </Text>\n            ) : (\n              <Text>Running on </Text>\n            )}\n            <Text color=\"green\">{`http://localhost:${port}/mcp`}</Text>\n          </Box>\n          <Box marginBottom={1}>\n            <Text color=\"#20a832\">→{\"  \"}</Text>\n            <Text color=\"white\" bold>\n              Test locally with DevTools:{\" \"}\n            </Text>\n            <Text color=\"green\">{`http://localhost:${port}/`}</Text>\n          </Box>\n\n          {tunnelState.status === \"idle\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text>Get a public URL and LLM Playground access with </Text>\n              <Text color=\"cyan\" bold>\n                --tunnel\n              </Text>\n              <Text>.</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"starting\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text color=\"yellow\">{tunnelState.message}</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"connected\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text>Exposed on </Text>\n                <Text color=\"green\">{`${tunnelState.url}/mcp`}</Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"white\" bold>\n                  Test with an LLM on Playground:{\" \"}\n                </Text>\n                <Text color=\"green\">{`${tunnelState.url}/try`}</Text>\n              </Box>\n            </Box>\n          )}\n          {tunnelState.status === \"error\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text color=\"red\">\n                  Cannot open tunnel: {tunnelState.message}\n                </Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"red\">{`Try manually: npx alpic tunnel --port ${port}`}</Text>\n              </Box>\n            </Box>\n          )}\n\n          <Box>\n            <Text>🛟{\"  \"}</Text>\n            <Text>Need help? Reach us on </Text>\n            <Text color=\"white\" underline>\n              https://discord.alpic.ai\n            </Text>\n          </Box>\n\n          {tsErrors.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"red\" bold>\n                ⚠️ TypeScript errors found:\n              </Text>\n              {tsErrors.map((error) => (\n                <Box\n                  key={`${error.file}:${error.line}:${error.col}`}\n                  marginLeft={2}\n                  flexDirection=\"column\"\n                >\n                  <Box>\n                    <Text color=\"white\">{error.file}</Text>\n                    <Text color=\"grey\">\n                      ({error.line},{error.col}):{\" \"}\n                    </Text>\n                  </Box>\n                  <Box marginLeft={2}>\n                    <Text color=\"red\">{error.message}</Text>\n                  </Box>\n                </Box>\n              ))}\n            </Box>\n          )}\n          {messages.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"white\" bold>\n                Logs:\n              </Text>\n              {messages.map((message) => (\n                <Box key={message.id} marginLeft={2}>\n                  {message.type === \"restart\" ? (\n                    <>\n                      <Text color=\"green\">✓{\"  \"}</Text>\n                      <Text color=\"white\">{message.text}</Text>\n                    </>\n                  ) : message.type === \"error\" ? (\n                    <Text color=\"red\">{message.text}</Text>\n                  ) : (\n                    <Text>{message.text}</Text>\n                  )}\n                </Box>\n              ))}\n            </Box>\n          )}\n        </Box>\n      );\n    };\n\n    // Note: `exitOnCtrlC: false` because we own SIGINT below to guarantee\n    // alpic gets killed before we exit. If anything ever calls `useInput` or\n    // puts stdin into raw mode, also wire an explicit `\\x03` keypress to the\n    // shutdown function — Ink will otherwise swallow Ctrl-C without ever\n    // delivering SIGINT.\n    const ink = render(<App />, { exitOnCtrlC: false, patchConsole: true });\n\n    // Synchronous-first shutdown: kill the alpic subprocess up front so we\n    // can't leave it orphaned even if another SIGINT listener (e.g. nodemon's)\n    // exits the process before our async cleanup completes.\n    const shutdown = (code: number) => () => {\n      tunnelManager.stop();\n      void closeTunnelControl()\n        .catch((err) => {\n          console.error(\"Failed to close tunnel control server\", err);\n        })\n        .finally(() => {\n          ink.unmount();\n          process.exit(code);\n        });\n    };\n    process.once(\"SIGINT\", shutdown(130));\n    process.once(\"SIGTERM\", shutdown(143));\n  }\n}\n"]}
+{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,CAAC,OAAO,OAAO,GAAI,SAAQ,OAAO;IACtC,MAAM,CAAU,WAAW,GAAG,0BAA0B,CAAC;IACzD,MAAM,CAAU,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,CAAU,KAAK,GAAG;QACtB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,2BAA2B;YACxC,GAAG,EAAE,CAAC;SACP,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YACpB,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,OAAO;YAC/C,OAAO,EAAE,IAAI;SACd,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,KAAK;SACf,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACnB,WAAW,EACT,oJAAoJ;YACtJ,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAExC,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,oBAAoB,CAAC,IAAI,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,qEAAqE;YACrE,6DAA6D;QAC/D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,EACJ,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,kBAAkB,GAC1B,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,GAAG,GAAG;YACV,GAAG,OAAO,CAAC,GAAG;YACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;YACpB,qBAAqB,EAAE,MAAM,CAAC,WAAW,CAAC;SAC3C,CAAC;QAEF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,QAAQ,CAAC;gBACxB,GAAG;gBACH,IAAI;gBACJ,QAAQ;gBACR,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa;aACd,CAAC,CAAC;YAEH,uEAAuE;YACvE,gEAAgE;YAChE,mEAAmE;YACnE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,EAAE;gBACtC,aAAa,CAAC,IAAI,EAAE,CAAC;gBACrB,QAAQ,EAAE,CAAC;gBACX,KAAK,kBAAkB,EAAE;qBACtB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;gBAC9D,CAAC,CAAC;qBACD,OAAO,CAAC,GAAG,EAAE;oBACZ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;YACP,CAAC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,WAAW,EAAE,CAAC;YAC9C,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7B,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,SAAS,CAC3B,IAAI,EACJ,WAAW,EACX,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CACb,CAAC;YAEF,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,aACnD,KAAC,MAAM,IAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,GAAI,EAExC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACpB,QAAQ,CAAC,CAAC,CAAC,CACV,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,yCAAgC,CACrD,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,8BAAmB,CACzB,EACD,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,MAAM,GAAQ,IACvD,EACN,MAAC,GAAG,IAAC,YAAY,EAAE,CAAC,aAClB,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,kDACM,GAAG,IAC1B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,oBAAoB,IAAI,GAAG,GAAQ,IACpD,EAEL,WAAW,CAAC,MAAM,KAAK,MAAM,IAAI,CAChC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,mEAAwD,EAC7D,KAAC,IAAI,IAAC,KAAK,EAAC,MAAM,EAAC,IAAI,+BAEhB,EACP,KAAC,IAAI,oBAAS,IACV,CACP,EACA,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,CACpC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,IAAC,KAAK,EAAC,QAAQ,YAAE,WAAW,CAAC,OAAO,GAAQ,IAC7C,CACP,EACA,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,CACrC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,8BAAmB,EACxB,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,sDACU,GAAG,IAC9B,EACP,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,GAAG,WAAW,CAAC,GAAG,MAAM,GAAQ,IACjD,IACF,CACP,EACA,WAAW,CAAC,MAAM,KAAK,OAAO,IAAI,CACjC,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,YAAY,EAAE,CAAC,aACzC,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,MAAC,IAAI,IAAC,KAAK,EAAC,KAAK,qCACM,WAAW,CAAC,OAAO,IACnC,IACH,EACN,MAAC,GAAG,eACF,MAAC,IAAI,IAAC,KAAK,EAAC,SAAS,uBAAG,IAAI,IAAQ,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,yCAAyC,IAAI,EAAE,GAAQ,IACtE,IACF,CACP,EAED,MAAC,GAAG,eACF,MAAC,IAAI,+BAAI,IAAI,IAAQ,EACrB,KAAC,IAAI,0CAA+B,EACpC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,SAAS,+CAEtB,IACH,EAEL,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,EAAC,IAAI,4DAEf,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACvB,MAAC,GAAG,IAEF,UAAU,EAAE,CAAC,EACb,aAAa,EAAC,QAAQ,aAEtB,MAAC,GAAG,eACF,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,KAAK,CAAC,IAAI,GAAQ,EACvC,MAAC,IAAI,IAAC,KAAK,EAAC,MAAM,kBACd,KAAK,CAAC,IAAI,OAAG,KAAK,CAAC,GAAG,QAAI,GAAG,IAC1B,IACH,EACN,KAAC,GAAG,IAAC,UAAU,EAAE,CAAC,YAChB,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,KAAK,CAAC,OAAO,GAAQ,GACpC,KAZD,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,CAa3C,CACP,CAAC,IACE,CACP,EACA,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CACtB,MAAC,GAAG,IAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAC,QAAQ,aACvC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,EAAC,IAAI,4BAEjB,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACzB,KAAC,GAAG,IAAkB,UAAU,EAAE,CAAC,YAChC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAC5B,8BACE,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,uBAAG,IAAI,IAAQ,EAClC,KAAC,IAAI,IAAC,KAAK,EAAC,OAAO,YAAE,OAAO,CAAC,IAAI,GAAQ,IACxC,CACJ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAC7B,KAAC,IAAI,IAAC,KAAK,EAAC,KAAK,YAAE,OAAO,CAAC,IAAI,GAAQ,CACxC,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,cAAE,OAAO,CAAC,IAAI,GAAQ,CAC5B,IAVO,OAAO,CAAC,EAAE,CAWd,CACP,CAAC,IACE,CACP,IACG,CACP,CAAC;QACJ,CAAC,CAAC;QAEF,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAC,GAAG,KAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,uEAAuE;QACvE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,EAAE;YACtC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,kBAAkB,EAAE;iBACtB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC","sourcesContent":["import { Command, Flags } from \"@oclif/core\";\nimport { Box, render, Text } from \"ink\";\nimport { resolvePort } from \"../cli/detect-port.js\";\nimport { Header } from \"../cli/header.js\";\nimport { resolveViewsDir } from \"../cli/resolve-views-dir.js\";\nimport { runPlain } from \"../cli/run-plain.js\";\nimport { startTunnelControlServer } from \"../cli/tunnel-control-server.js\";\nimport { useMessages } from \"../cli/use-messages.js\";\nimport { useNodemon } from \"../cli/use-nodemon.js\";\nimport { useOpenBrowser } from \"../cli/use-open-browser.js\";\nimport { useTunnel } from \"../cli/use-tunnel.js\";\nimport { useTypeScriptCheck } from \"../cli/use-typescript-check.js\";\nimport { scanAndWriteViewsDts } from \"../web/plugin/scan-views.js\";\n\nexport default class Dev extends Command {\n  static override description = \"Start development server\";\n  static override examples = [\"skybridge\"];\n  static override flags = {\n    port: Flags.integer({\n      char: \"p\",\n      description: \"Port to run the server on\",\n      min: 1,\n    }),\n    tunnel: Flags.boolean({\n      description: \"Open an Alpic tunnel for remote testing\",\n      default: false,\n    }),\n    open: Flags.boolean({\n      description: \"Open DevTools in the browser when the server is ready\",\n      default: process.env.SKYBRIDGE_OPEN !== \"false\",\n      allowNo: true,\n    }),\n    verbose: Flags.boolean({\n      char: \"v\",\n      description: \"Show tunnel logs\",\n      default: false,\n    }),\n    plain: Flags.boolean({\n      description:\n        \"Disable the interactive UI and stream raw server logs to stdout, so you can pipe them through a formatter (e.g. `skybridge dev --plain | bunyan`).\",\n      default: false,\n    }),\n  };\n\n  public async run(): Promise<void> {\n    const { flags } = await this.parse(Dev);\n\n    // Generate .skybridge/views.d.ts before render() spawns `tsc --noEmit\n    // --watch`. Vite's plugin config hook writes the same file when nodemon\n    // boots the server, but tsc starts in parallel — if .skybridge/ doesn't\n    // exist at tsc startup, its watcher never picks up the late-created file\n    // and the dev UI reports phantom TS errors forever.\n    const root = process.cwd();\n    try {\n      scanAndWriteViewsDts(root, await resolveViewsDir(root));\n    } catch {\n      // Best-effort: if the scan fails (e.g. broken vite config, duplicate\n      // view names) tsc may show phantom errors, but the dev server should\n      // still start so the developer can fix the underlying issue.\n    }\n\n    const { port, fallback, envWarning } = await resolvePort(flags.port);\n    if (envWarning) {\n      this.warn(envWarning);\n    }\n\n    const {\n      port: controlPort,\n      manager: tunnelManager,\n      close: closeTunnelControl,\n    } = await startTunnelControlServer(() => port);\n\n    const env = {\n      ...process.env,\n      __PORT: String(port),\n      __TUNNEL_CONTROL_PORT: String(controlPort),\n    };\n\n    if (flags.plain) {\n      const teardown = runPlain({\n        env,\n        port,\n        fallback,\n        version: this.config.version,\n        tunnel: flags.tunnel,\n        tunnelManager,\n      });\n\n      // Synchronous-first shutdown: kill the alpic subprocess up front so we\n      // can't leave it orphaned even if another SIGINT listener (e.g.\n      // nodemon's) exits the process before our async cleanup completes.\n      const shutdown = (code: number) => () => {\n        tunnelManager.stop();\n        teardown();\n        void closeTunnelControl()\n          .catch((err) => {\n            console.error(\"Failed to close tunnel control server\", err);\n          })\n          .finally(() => {\n            process.exit(code);\n          });\n      };\n      process.once(\"SIGINT\", shutdown(130));\n      process.once(\"SIGTERM\", shutdown(143));\n      return;\n    }\n\n    const App = () => {\n      const tsErrors = useTypeScriptCheck();\n      const [messages, pushMessage] = useMessages();\n      useNodemon(env, pushMessage);\n      useOpenBrowser(port, flags.open);\n      const tunnelState = useTunnel(\n        port,\n        pushMessage,\n        flags.verbose,\n        flags.tunnel,\n      );\n\n      return (\n        <Box flexDirection=\"column\" padding={1} marginLeft={1}>\n          <Header version={this.config.version} />\n\n          <Box>\n            <Text>🏠{\"  \"}</Text>\n            {fallback ? (\n              <Text color=\"yellow\">3000 in use, running on </Text>\n            ) : (\n              <Text>Running on </Text>\n            )}\n            <Text color=\"green\">{`http://localhost:${port}/mcp`}</Text>\n          </Box>\n          <Box marginBottom={1}>\n            <Text color=\"#20a832\">→{\"  \"}</Text>\n            <Text color=\"white\" bold>\n              Test locally with DevTools:{\" \"}\n            </Text>\n            <Text color=\"green\">{`http://localhost:${port}/`}</Text>\n          </Box>\n\n          {tunnelState.status === \"idle\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text>Get a public URL and LLM Playground access with </Text>\n              <Text color=\"cyan\" bold>\n                --tunnel\n              </Text>\n              <Text>.</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"starting\" && (\n            <Box>\n              <Text>🌍{\"  \"}</Text>\n              <Text color=\"yellow\">{tunnelState.message}</Text>\n            </Box>\n          )}\n          {tunnelState.status === \"connected\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text>Exposed on </Text>\n                <Text color=\"green\">{`${tunnelState.url}/mcp`}</Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"white\" bold>\n                  Test with an LLM on Playground:{\" \"}\n                </Text>\n                <Text color=\"green\">{`${tunnelState.url}/try`}</Text>\n              </Box>\n            </Box>\n          )}\n          {tunnelState.status === \"error\" && (\n            <Box flexDirection=\"column\" marginBottom={1}>\n              <Box>\n                <Text>🌍{\"  \"}</Text>\n                <Text color=\"red\">\n                  Cannot open tunnel: {tunnelState.message}\n                </Text>\n              </Box>\n              <Box>\n                <Text color=\"#20a832\">→{\"  \"}</Text>\n                <Text color=\"red\">{`Try manually: npx alpic tunnel --port ${port}`}</Text>\n              </Box>\n            </Box>\n          )}\n\n          <Box>\n            <Text>🛟{\"  \"}</Text>\n            <Text>Need help? Reach us on </Text>\n            <Text color=\"white\" underline>\n              https://discord.alpic.ai\n            </Text>\n          </Box>\n\n          {tsErrors.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"red\" bold>\n                ⚠️ TypeScript errors found:\n              </Text>\n              {tsErrors.map((error) => (\n                <Box\n                  key={`${error.file}:${error.line}:${error.col}`}\n                  marginLeft={2}\n                  flexDirection=\"column\"\n                >\n                  <Box>\n                    <Text color=\"white\">{error.file}</Text>\n                    <Text color=\"grey\">\n                      ({error.line},{error.col}):{\" \"}\n                    </Text>\n                  </Box>\n                  <Box marginLeft={2}>\n                    <Text color=\"red\">{error.message}</Text>\n                  </Box>\n                </Box>\n              ))}\n            </Box>\n          )}\n          {messages.length > 0 && (\n            <Box marginTop={1} flexDirection=\"column\">\n              <Text color=\"white\" bold>\n                Logs:\n              </Text>\n              {messages.map((message) => (\n                <Box key={message.id} marginLeft={2}>\n                  {message.type === \"restart\" ? (\n                    <>\n                      <Text color=\"green\">✓{\"  \"}</Text>\n                      <Text color=\"white\">{message.text}</Text>\n                    </>\n                  ) : message.type === \"error\" ? (\n                    <Text color=\"red\">{message.text}</Text>\n                  ) : (\n                    <Text>{message.text}</Text>\n                  )}\n                </Box>\n              ))}\n            </Box>\n          )}\n        </Box>\n      );\n    };\n\n    // Note: `exitOnCtrlC: false` because we own SIGINT below to guarantee\n    // alpic gets killed before we exit. If anything ever calls `useInput` or\n    // puts stdin into raw mode, also wire an explicit `\\x03` keypress to the\n    // shutdown function — Ink will otherwise swallow Ctrl-C without ever\n    // delivering SIGINT.\n    const ink = render(<App />, { exitOnCtrlC: false, patchConsole: true });\n\n    // Synchronous-first shutdown: kill the alpic subprocess up front so we\n    // can't leave it orphaned even if another SIGINT listener (e.g. nodemon's)\n    // exits the process before our async cleanup completes.\n    const shutdown = (code: number) => () => {\n      tunnelManager.stop();\n      void closeTunnelControl()\n        .catch((err) => {\n          console.error(\"Failed to close tunnel control server\", err);\n        })\n        .finally(() => {\n          ink.unmount();\n          process.exit(code);\n        });\n    };\n    process.once(\"SIGINT\", shutdown(130));\n    process.once(\"SIGTERM\", shutdown(143));\n  }\n}\n"]}

package/dist/server/auth/providers/custom.d.ts

@@ -16,6 +16,13 @@ export type CustomProviderOptions = {
      * injects the registration endpoint). Use the static public URL; `verify.issuer`
      * stays the IdP (the token's real `iss`). */
     serverUrl?: string;
+    /** Advertise this URL as the authorization server (served AS metadata `issuer`
+     * and PRM `authorization_servers`) while `verify.issuer` stays the IdP's `iss`.
+     * Its own discovery document supplies the advertised endpoints, DCR
+     * registration and scopes. Use when DCR/authorize/token live at a different URL
+     * than the token issuer (e.g. Descope's agentic URL vs. its base-project
+     * issuer). `serverUrl` wins if both are set. */
+    authorizationServer?: string;
     scopes?: string[];
     requiredScopes?: string[];
     metadataOverrides?: Omit<Partial<OAuthMetadata>, "issuer">;

package/dist/server/auth/providers/custom.js

@@ -11,14 +11,26 @@ export async function customProvider(opts) {
     // Overrides adjust only advertised metadata; the trust anchor (issuer, jwks_uri)
     // always comes from validated discovery.
     const { issuer: _issuer, jwks_uri: _jwks, ...overrides } = opts.metadataOverrides ?? {};
-    const base = { ...discovered, ...overrides };
+    let advertised = discovered;
+    if (opts.authorizationServer) {
+        try {
+            advertised = await discoverAuthorizationServer(opts.authorizationServer);
+        }
+        catch (err) {
+            console.warn(`OAuth discovery failed for authorizationServer ${opts.authorizationServer}; advertising ${opts.issuer} metadata instead: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const base = { ...advertised, ...overrides };
     const scopesSupported = opts.scopes ?? base.scopes_supported;
-    // serverUrl => skybridge-as-AS: advertise this server's URL as the issuer (and
-    // keep the served scopes in sync). The verifier still trusts the IdP's `iss`.
-    const oauthMetadata = opts.serverUrl
+    // serverUrl (skybridge-as-AS) or authorizationServer (a distinct AS URL)
+    // override the advertised issuer (and keep the served scopes in sync). The
+    // verifier still trusts the IdP's `iss`. serverUrl wins when both are set.
+    const advertisedIssuer = opts.serverUrl?.replace(/\/$/, "") ??
+        opts.authorizationServer?.replace(/\/$/, "");
+    const oauthMetadata = advertisedIssuer
         ? {
             ...base,
-            issuer: opts.serverUrl.replace(/\/$/, ""),
+            issuer: advertisedIssuer,
             scopes_supported: scopesSupported,
         }
         : base;
@@ -26,7 +38,9 @@ export async function customProvider(opts) {
         baseUrl: opts.baseUrl,
         oauthMetadata,
         verify: {
-            issuer: discovered.issuer,
+            issuer: advertised.issuer === discovered.issuer
+                ? discovered.issuer
+                : [discovered.issuer, advertised.issuer],
             audience: opts.audience,
             jwksUri: discovered.jwks_uri,
         },

package/dist/server/auth/providers/custom.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAwBzB,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElE,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,yCAAyC;IACzC,MAAM,EACJ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,GAAG,SAAS,EACb,GAAgC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAuB,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAE7D,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,aAAa,GAAuB,IAAI,CAAC,SAAS;QACtD,CAAC,CAAC;YACE,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzC,gBAAgB,EAAE,eAAe;SAClC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,UAAU,CAAC,QAAQ;SAC7B;QACD,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig } from \"../index.js\";\n\n/** Options accepted by {@link customProvider} and the branded providers. */\nexport type CustomProviderOptions = {\n  issuer: string;\n  /** Expected token `aud`. Omit to skip audience verification — only for IdPs\n   * that don't bind an audience (e.g. Clerk). Branded providers whose IdP does\n   * bind an audience re-require it in their own options. */\n  audience?: string;\n  /** Omit to let the server infer the resource origin from request headers. */\n  baseUrl?: string;\n  /** Advertise THIS server as the authorization server (skybridge-as-AS): the\n   * served AS metadata `issuer` and the PRM `authorization_servers` use this URL\n   * instead of the IdP's. Needed when skybridge must sit in the auth path — Auth0\n   * (the `audience` must be baked into `/authorize`) or the Alpic DCR proxy (Alpic\n   * injects the registration endpoint). Use the static public URL; `verify.issuer`\n   * stays the IdP (the token's real `iss`). */\n  serverUrl?: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  metadataOverrides?: Omit<Partial<OAuthMetadata>, \"issuer\">;\n};\n\n/** Builds a complete {@link OAuthConfig} from an IdP's OAuth discovery document. */\nexport async function customProvider(\n  opts: CustomProviderOptions,\n): Promise<OAuthConfig> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n\n  // JWKS verification needs a signing-key URL; without it the server can't verify\n  // tokens. (`registration_endpoint` is optional per RFC 8414 — a no-DCR IdP simply\n  // omits it; a proxy like Alpic, or pre-registered clients, supply registration.)\n  if (!discovered.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  // Overrides adjust only advertised metadata; the trust anchor (issuer, jwks_uri)\n  // always comes from validated discovery.\n  const {\n    issuer: _issuer,\n    jwks_uri: _jwks,\n    ...overrides\n  }: Partial<DiscoveredMetadata> = opts.metadataOverrides ?? {};\n  const base: DiscoveredMetadata = { ...discovered, ...overrides };\n  const scopesSupported = opts.scopes ?? base.scopes_supported;\n\n  // serverUrl => skybridge-as-AS: advertise this server's URL as the issuer (and\n  // keep the served scopes in sync). The verifier still trusts the IdP's `iss`.\n  const oauthMetadata: DiscoveredMetadata = opts.serverUrl\n    ? {\n        ...base,\n        issuer: opts.serverUrl.replace(/\\/$/, \"\"),\n        scopes_supported: scopesSupported,\n      }\n    : base;\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verify: {\n      issuer: discovered.issuer,\n      audience: opts.audience,\n      jwksUri: discovered.jwks_uri,\n    },\n    scopesSupported,\n    requiredScopes: opts.requiredScopes,\n  };\n}\n"]}
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AA+BzB,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElE,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,yCAAyC;IACzC,MAAM,EACJ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,GAAG,SAAS,EACb,GAAgC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9D,IAAI,UAAU,GAAG,UAAU,CAAC;IAC5B,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,kDAAkD,IAAI,CAAC,mBAAmB,iBAAiB,IAAI,CAAC,MAAM,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/K,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAuB,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAE7D,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,gBAAgB,GACpB,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAuB,gBAAgB;QACxD,CAAC,CAAC;YACE,GAAG,IAAI;YACP,MAAM,EAAE,gBAAgB;YACxB,gBAAgB,EAAE,eAAe;SAClC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,MAAM,EAAE;YACN,MAAM,EACJ,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;gBACrC,CAAC,CAAC,UAAU,CAAC,MAAM;gBACnB,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,UAAU,CAAC,QAAQ;SAC7B;QACD,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig } from \"../index.js\";\n\n/** Options accepted by {@link customProvider} and the branded providers. */\nexport type CustomProviderOptions = {\n  issuer: string;\n  /** Expected token `aud`. Omit to skip audience verification — only for IdPs\n   * that don't bind an audience (e.g. Clerk). Branded providers whose IdP does\n   * bind an audience re-require it in their own options. */\n  audience?: string;\n  /** Omit to let the server infer the resource origin from request headers. */\n  baseUrl?: string;\n  /** Advertise THIS server as the authorization server (skybridge-as-AS): the\n   * served AS metadata `issuer` and the PRM `authorization_servers` use this URL\n   * instead of the IdP's. Needed when skybridge must sit in the auth path — Auth0\n   * (the `audience` must be baked into `/authorize`) or the Alpic DCR proxy (Alpic\n   * injects the registration endpoint). Use the static public URL; `verify.issuer`\n   * stays the IdP (the token's real `iss`). */\n  serverUrl?: string;\n  /** Advertise this URL as the authorization server (served AS metadata `issuer`\n   * and PRM `authorization_servers`) while `verify.issuer` stays the IdP's `iss`.\n   * Its own discovery document supplies the advertised endpoints, DCR\n   * registration and scopes. Use when DCR/authorize/token live at a different URL\n   * than the token issuer (e.g. Descope's agentic URL vs. its base-project\n   * issuer). `serverUrl` wins if both are set. */\n  authorizationServer?: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  metadataOverrides?: Omit<Partial<OAuthMetadata>, \"issuer\">;\n};\n\n/** Builds a complete {@link OAuthConfig} from an IdP's OAuth discovery document. */\nexport async function customProvider(\n  opts: CustomProviderOptions,\n): Promise<OAuthConfig> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n\n  // JWKS verification needs a signing-key URL; without it the server can't verify\n  // tokens. (`registration_endpoint` is optional per RFC 8414 — a no-DCR IdP simply\n  // omits it; a proxy like Alpic, or pre-registered clients, supply registration.)\n  if (!discovered.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  // Overrides adjust only advertised metadata; the trust anchor (issuer, jwks_uri)\n  // always comes from validated discovery.\n  const {\n    issuer: _issuer,\n    jwks_uri: _jwks,\n    ...overrides\n  }: Partial<DiscoveredMetadata> = opts.metadataOverrides ?? {};\n  let advertised = discovered;\n  if (opts.authorizationServer) {\n    try {\n      advertised = await discoverAuthorizationServer(opts.authorizationServer);\n    } catch (err) {\n      console.warn(\n        `OAuth discovery failed for authorizationServer ${opts.authorizationServer}; advertising ${opts.issuer} metadata instead: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n  const base: DiscoveredMetadata = { ...advertised, ...overrides };\n  const scopesSupported = opts.scopes ?? base.scopes_supported;\n\n  // serverUrl (skybridge-as-AS) or authorizationServer (a distinct AS URL)\n  // override the advertised issuer (and keep the served scopes in sync). The\n  // verifier still trusts the IdP's `iss`. serverUrl wins when both are set.\n  const advertisedIssuer =\n    opts.serverUrl?.replace(/\\/$/, \"\") ??\n    opts.authorizationServer?.replace(/\\/$/, \"\");\n  const oauthMetadata: DiscoveredMetadata = advertisedIssuer\n    ? {\n        ...base,\n        issuer: advertisedIssuer,\n        scopes_supported: scopesSupported,\n      }\n    : base;\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verify: {\n      issuer:\n        advertised.issuer === discovered.issuer\n          ? discovered.issuer\n          : [discovered.issuer, advertised.issuer],\n      audience: opts.audience,\n      jwksUri: discovered.jwks_uri,\n    },\n    scopesSupported,\n    requiredScopes: opts.requiredScopes,\n  };\n}\n"]}

package/dist/server/auth/providers/custom.test.js

@@ -1,9 +1,13 @@
 // @vitest-environment node
 import http from "node:http";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import { customProvider } from "./custom.js";
-let server;
-afterEach(() => server?.close());
+const servers = [];
+afterEach(() => {
+    for (const srv of servers.splice(0)) {
+        srv.close();
+    }
+});
 function doc(origin, extra = {}) {
     return {
         issuer: origin,
@@ -28,7 +32,7 @@ async function serveDiscovery(extra = {}) {
         res.end(JSON.stringify(doc(origin, extra)));
     });
     await new Promise((resolve) => srv.listen(0, resolve));
-    server = srv;
+    servers.push(srv);
     origin = `http://localhost:${srv.address().port}`;
     return origin;
 }
@@ -93,6 +97,51 @@ describe("customProvider", () => {
         // but the token's issuer is still verified against the IdP.
         expect(config.verify.issuer).toBe(base);
     });
+    it("authorizationServer supplies the advertised metadata, keeping the discovered issuer for verification", async () => {
+        const base = await serveDiscovery();
+        const as = await serveDiscovery({ scopes_supported: ["checkout"] });
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            authorizationServer: `${as}/`,
+        });
+        expect(config.oauthMetadata.issuer).toBe(as);
+        expect(config.oauthMetadata.authorization_endpoint).toBe(`${as}/authorize`);
+        expect(config.oauthMetadata.registration_endpoint).toBe(`${as}/register`);
+        expect(config.scopesSupported).toEqual(["checkout"]);
+        expect(config.verify).toEqual({
+            issuer: [base, as],
+            audience: "a",
+            jwksUri: `${base}/jwks`,
+        });
+    });
+    it("falls back to the issuer's metadata when the authorizationServer is undiscoverable", async () => {
+        const base = await serveDiscovery();
+        const warn = vi.spyOn(console, "warn").mockImplementation(() => { });
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            authorizationServer: `${base}/agentic/P1/MS1`,
+        });
+        expect(warn).toHaveBeenCalledOnce();
+        expect(config.oauthMetadata.issuer).toBe(`${base}/agentic/P1/MS1`);
+        expect(config.oauthMetadata.authorization_endpoint).toBe(`${base}/authorize`);
+        expect(config.verify.issuer).toBe(base);
+        warn.mockRestore();
+    });
+    it("serverUrl takes precedence over authorizationServer", async () => {
+        const base = await serveDiscovery();
+        const as = await serveDiscovery();
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            serverUrl: "https://app.example.test/",
+            authorizationServer: as,
+        });
+        expect(config.oauthMetadata.issuer).toBe("https://app.example.test");
+        expect(config.oauthMetadata.token_endpoint).toBe(`${as}/token`);
+        expect(config.verify.issuer).toEqual([base, as]);
+    });
     it("applies metadataOverrides over discovered values", async () => {
         const base = await serveDiscovery();
         const config = await customProvider({

package/dist/server/auth/providers/custom.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAAC,QAAiC,EAAE;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,GAAG,KAAK,mCAAmC,EAAE,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,IAAI,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAW;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAW;SACnE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CACV,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAChD,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,2BAA2B;YACtC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QACH,uDAAuD;QACvD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,4DAA4D;QAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;YACnC,iBAAiB,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { customProvider } from \"./custom.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\", \"profile\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves the discovery doc (built from the live origin) at the OIDC well-known path.\nasync function serveDiscovery(extra: Record<string, unknown> = {}) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    if (req.url !== \"/.well-known/openid-configuration\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(doc(origin, extra)));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"customProvider\", () => {\n  it(\"builds an OAuthConfig from discovery\", async () => {\n    const base = await serveDiscovery();\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"my-api\",\n      baseUrl: \"https://app.example.test\",\n      scopes: [\"openid\"],\n    });\n\n    expect(config.baseUrl).toBe(\"https://app.example.test\");\n    expect(config.verify).toEqual({\n      issuer: base,\n      audience: \"my-api\",\n      jwksUri: `${base}/jwks`,\n    });\n    expect(config.scopesSupported).toEqual([\"openid\"]);\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"ignores a runtime issuer override (keeps the discovered trust anchor)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { issuer: \"https://evil.test\" } as never,\n    });\n    expect(config.verify.issuer).toBe(base);\n    expect(config.oauthMetadata.issuer).toBe(base);\n  });\n\n  it(\"ignores a runtime jwks_uri override (keeps the discovered signing keys)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { jwks_uri: \"https://evil.test/keys\" } as never,\n    });\n    expect(config.verify.jwksUri).toBe(`${base}/jwks`);\n  });\n\n  it(\"serves metadata without a registration_endpoint when the IdP has no DCR\", async () => {\n    const base = await serveDiscovery({ registration_endpoint: undefined });\n    const config = await customProvider({ issuer: base, audience: \"a\" });\n    expect(config.oauthMetadata.registration_endpoint).toBeUndefined();\n    expect(config.verify.issuer).toBe(base);\n  });\n\n  it(\"throws when discovery has no jwks_uri (token verification needs it)\", async () => {\n    const base = await serveDiscovery({ jwks_uri: undefined });\n    await expect(\n      customProvider({ issuer: base, audience: \"a\" }),\n    ).rejects.toThrow(/jwks_uri/);\n  });\n\n  it(\"serverUrl advertises this server as the AS, keeping the IdP as the token issuer\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      serverUrl: \"https://app.example.test/\",\n      scopes: [\"openid\"],\n    });\n    // AS metadata + advertised scopes reflect this server.\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.test\");\n    expect(config.oauthMetadata.scopes_supported).toEqual([\"openid\"]);\n    // but the token's issuer is still verified against the IdP.\n    expect(config.verify.issuer).toBe(base);\n  });\n\n  it(\"applies metadataOverrides over discovered values\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n      metadataOverrides: { token_endpoint: \"https://override/token\" },\n    });\n    expect(config.oauthMetadata.token_endpoint).toBe(\"https://override/token\");\n  });\n});\n"]}
+{"version":3,"file":"custom.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,OAAO,GAAkB,EAAE,CAAC;AAClC,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAAC,QAAiC,EAAE;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,GAAG,KAAK,mCAAmC,EAAE,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,IAAI,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAW;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAW;SACnE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CACV,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAChD,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,2BAA2B;YACtC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QACH,uDAAuD;QACvD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,4DAA4D;QAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;QACpH,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,GAAG,EAAE,GAAG;SAC9B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAClB,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,GAAG,IAAI,OAAO;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,GAAG,IAAI,iBAAiB;SAC9C,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,IAAI,CACtD,GAAG,IAAI,YAAY,CACpB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,2BAA2B;YACtC,mBAAmB,EAAE,EAAE;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;YACnC,iBAAiB,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { customProvider } from \"./custom.js\";\n\nconst servers: http.Server[] = [];\nafterEach(() => {\n  for (const srv of servers.splice(0)) {\n    srv.close();\n  }\n});\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\", \"profile\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves the discovery doc (built from the live origin) at the OIDC well-known path.\nasync function serveDiscovery(extra: Record<string, unknown> = {}) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    if (req.url !== \"/.well-known/openid-configuration\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(doc(origin, extra)));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  servers.push(srv);\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"customProvider\", () => {\n  it(\"builds an OAuthConfig from discovery\", async () => {\n    const base = await serveDiscovery();\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"my-api\",\n      baseUrl: \"https://app.example.test\",\n      scopes: [\"openid\"],\n    });\n\n    expect(config.baseUrl).toBe(\"https://app.example.test\");\n    expect(config.verify).toEqual({\n      issuer: base,\n      audience: \"my-api\",\n      jwksUri: `${base}/jwks`,\n    });\n    expect(config.scopesSupported).toEqual([\"openid\"]);\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"ignores a runtime issuer override (keeps the discovered trust anchor)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { issuer: \"https://evil.test\" } as never,\n    });\n    expect(config.verify.issuer).toBe(base);\n    expect(config.oauthMetadata.issuer).toBe(base);\n  });\n\n  it(\"ignores a runtime jwks_uri override (keeps the discovered signing keys)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { jwks_uri: \"https://evil.test/keys\" } as never,\n    });\n    expect(config.verify.jwksUri).toBe(`${base}/jwks`);\n  });\n\n  it(\"serves metadata without a registration_endpoint when the IdP has no DCR\", async () => {\n    const base = await serveDiscovery({ registration_endpoint: undefined });\n    const config = await customProvider({ issuer: base, audience: \"a\" });\n    expect(config.oauthMetadata.registration_endpoint).toBeUndefined();\n    expect(config.verify.issuer).toBe(base);\n  });\n\n  it(\"throws when discovery has no jwks_uri (token verification needs it)\", async () => {\n    const base = await serveDiscovery({ jwks_uri: undefined });\n    await expect(\n      customProvider({ issuer: base, audience: \"a\" }),\n    ).rejects.toThrow(/jwks_uri/);\n  });\n\n  it(\"serverUrl advertises this server as the AS, keeping the IdP as the token issuer\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      serverUrl: \"https://app.example.test/\",\n      scopes: [\"openid\"],\n    });\n    // AS metadata + advertised scopes reflect this server.\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.test\");\n    expect(config.oauthMetadata.scopes_supported).toEqual([\"openid\"]);\n    // but the token's issuer is still verified against the IdP.\n    expect(config.verify.issuer).toBe(base);\n  });\n\n  it(\"authorizationServer supplies the advertised metadata, keeping the discovered issuer for verification\", async () => {\n    const base = await serveDiscovery();\n    const as = await serveDiscovery({ scopes_supported: [\"checkout\"] });\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      authorizationServer: `${as}/`,\n    });\n\n    expect(config.oauthMetadata.issuer).toBe(as);\n    expect(config.oauthMetadata.authorization_endpoint).toBe(`${as}/authorize`);\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${as}/register`);\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n    expect(config.verify).toEqual({\n      issuer: [base, as],\n      audience: \"a\",\n      jwksUri: `${base}/jwks`,\n    });\n  });\n\n  it(\"falls back to the issuer's metadata when the authorizationServer is undiscoverable\", async () => {\n    const base = await serveDiscovery();\n    const warn = vi.spyOn(console, \"warn\").mockImplementation(() => {});\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      authorizationServer: `${base}/agentic/P1/MS1`,\n    });\n\n    expect(warn).toHaveBeenCalledOnce();\n    expect(config.oauthMetadata.issuer).toBe(`${base}/agentic/P1/MS1`);\n    expect(config.oauthMetadata.authorization_endpoint).toBe(\n      `${base}/authorize`,\n    );\n    expect(config.verify.issuer).toBe(base);\n    warn.mockRestore();\n  });\n\n  it(\"serverUrl takes precedence over authorizationServer\", async () => {\n    const base = await serveDiscovery();\n    const as = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      serverUrl: \"https://app.example.test/\",\n      authorizationServer: as,\n    });\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.test\");\n    expect(config.oauthMetadata.token_endpoint).toBe(`${as}/token`);\n    expect(config.verify.issuer).toEqual([base, as]);\n  });\n\n  it(\"applies metadataOverrides over discovered values\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n      metadataOverrides: { token_endpoint: \"https://override/token\" },\n    });\n    expect(config.oauthMetadata.token_endpoint).toBe(\"https://override/token\");\n  });\n});\n"]}

package/dist/server/auth/providers/descope.js

@@ -23,10 +23,13 @@ function projectIdFromUrl(url) {
  */
 export function descopeProvider(opts) {
     const { url, audience, ...rest } = opts;
-    const issuer = url.replace(/\/\.well-known\/[^?#]*$/, "").replace(/\/$/, "");
+    const asUrl = url.replace(/\/\.well-known\/[^?#]*$/, "").replace(/\/$/, "");
+    const projectId = projectIdFromUrl(asUrl);
+    const issuer = `${asUrl.slice(0, asUrl.indexOf("/agentic/"))}/${projectId}`;
     return customProvider({
         issuer,
-        audience: audience ?? projectIdFromUrl(issuer),
+        audience: audience ?? projectId,
+        authorizationServer: asUrl,
         ...rest,
     });
 }

package/dist/server/auth/providers/descope.js.map

@@ -1 +1 @@
-{"version":3,"file":"descope.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzE;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,mCAAmC,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6D;IAE7D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC;QACpB,MAAM;QACN,QAAQ,EAAE,QAAQ,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAC9C,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\n\n/**\n * Derives the Descope Project ID from an MCP Server URL\n * (`…/agentic/<projectId>/<mcpServerId>`). Descope binds the token `aud` to the\n * project id, so it doubles as the audience.\n */\nfunction projectIdFromUrl(url: string): string {\n  const projectId = url.match(/\\/agentic\\/([^/]+)\\/[^/]+/)?.[1];\n  if (!projectId) {\n    throw new Error(\n      `Could not derive the Descope project id from \"${url}\"; pass an explicit \\`audience\\`.`,\n    );\n  }\n  return projectId;\n}\n\n/**\n * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery\n * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.\n * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your\n * custom domain). Requires DCR enabled on the MCP Server. For Descope with DCR\n * disabled and Alpic's DCR proxy, use {@link customProvider} with `serverUrl`\n * instead (see `examples/auth-descope-alpic`). The token `audience` defaults to\n * the **Project ID** derived from the URL — Descope binds `aud` to [DCR client\n * id, project id], not the server URL; pass `audience` to override.\n */\nexport function descopeProvider(\n  opts: { url: string } & Omit<CustomProviderOptions, \"issuer\">,\n): Promise<OAuthConfig> {\n  const { url, audience, ...rest } = opts;\n  const issuer = url.replace(/\\/\\.well-known\\/[^?#]*$/, \"\").replace(/\\/$/, \"\");\n  return customProvider({\n    issuer,\n    audience: audience ?? projectIdFromUrl(issuer),\n    ...rest,\n  });\n}\n"]}
+{"version":3,"file":"descope.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzE;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,mCAAmC,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6D;IAE7D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;IAC5E,OAAO,cAAc,CAAC;QACpB,MAAM;QACN,QAAQ,EAAE,QAAQ,IAAI,SAAS;QAC/B,mBAAmB,EAAE,KAAK;QAC1B,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\n\n/**\n * Derives the Descope Project ID from an MCP Server URL\n * (`…/agentic/<projectId>/<mcpServerId>`). Descope binds the token `aud` to the\n * project id, so it doubles as the audience.\n */\nfunction projectIdFromUrl(url: string): string {\n  const projectId = url.match(/\\/agentic\\/([^/]+)\\/[^/]+/)?.[1];\n  if (!projectId) {\n    throw new Error(\n      `Could not derive the Descope project id from \"${url}\"; pass an explicit \\`audience\\`.`,\n    );\n  }\n  return projectId;\n}\n\n/**\n * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery\n * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.\n * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your\n * custom domain). Requires DCR enabled on the MCP Server. For Descope with DCR\n * disabled and Alpic's DCR proxy, use {@link customProvider} with `serverUrl`\n * instead (see `examples/auth-descope-alpic`). The token `audience` defaults to\n * the **Project ID** derived from the URL — Descope binds `aud` to [DCR client\n * id, project id], not the server URL; pass `audience` to override.\n */\nexport function descopeProvider(\n  opts: { url: string } & Omit<CustomProviderOptions, \"issuer\">,\n): Promise<OAuthConfig> {\n  const { url, audience, ...rest } = opts;\n  const asUrl = url.replace(/\\/\\.well-known\\/[^?#]*$/, \"\").replace(/\\/$/, \"\");\n  const projectId = projectIdFromUrl(asUrl);\n  const issuer = `${asUrl.slice(0, asUrl.indexOf(\"/agentic/\"))}/${projectId}`;\n  return customProvider({\n    issuer,\n    audience: audience ?? projectId,\n    authorizationServer: asUrl,\n    ...rest,\n  });\n}\n"]}

package/dist/server/auth/providers/descope.test.js

@@ -2,35 +2,59 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { descopeProvider } from "./descope.js";
 afterEach(() => vi.restoreAllMocks());
-function discoveryDoc(issuer) {
+function discoveryDoc(issuer, scopes) {
     return {
         issuer,
         authorization_endpoint: `${issuer}/authorize`,
         token_endpoint: `${issuer}/token`,
         registration_endpoint: `${issuer}/register`,
         response_types_supported: ["code"],
-        scopes_supported: ["openid"],
+        scopes_supported: scopes,
         jwks_uri: `${issuer}/.well-known/jwks.json`,
     };
 }
-function mockDiscovery(issuer) {
-    return vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(discoveryDoc(issuer)), {
-        headers: { "content-type": "application/json" },
-    }));
+const PROJECT = "https://api.descope.com/v1/apps/P123";
+const AGENTIC = "https://api.descope.com/v1/apps/agentic/P123/MS456";
+// Serves each issuer its own document, so a request for one never resolves the other.
+function mockDiscovery(docs) {
+    return vi
+        .spyOn(globalThis, "fetch")
+        .mockImplementation(async (input) => {
+        const url = String(input);
+        const entry = Object.entries(docs).find(([issuer]) => url === `${issuer}/.well-known/openid-configuration`);
+        if (entry === undefined) {
+            return new Response(null, { status: 404 });
+        }
+        return new Response(JSON.stringify(discoveryDoc(...entry)), {
+            headers: { "content-type": "application/json" },
+        });
+    });
 }
 describe("descopeProvider", () => {
-    it("derives issuer and audience (project id) from the MCP Server URL", async () => {
-        const issuer = "https://api.descope.com/v1/apps/agentic/P123/MS456";
-        const fetchSpy = mockDiscovery(issuer);
-        const config = await descopeProvider({ url: issuer });
-        expect(fetchSpy).toHaveBeenCalledWith(`${issuer}/.well-known/openid-configuration`, expect.anything());
-        expect(config.verify.issuer).toBe(issuer);
+    it("accepts either issuer and advertises the agentic AS", async () => {
+        const fetchSpy = mockDiscovery({
+            [PROJECT]: ["openid", "profile", "email", "phone"],
+            [AGENTIC]: ["checkout"],
+        });
+        const config = await descopeProvider({ url: AGENTIC });
+        expect(fetchSpy).toHaveBeenCalledWith(`${PROJECT}/.well-known/openid-configuration`, expect.anything());
+        expect(config.verify.issuer).toEqual([PROJECT, AGENTIC]);
         expect(config.verify.audience).toBe("P123");
+        expect(config.oauthMetadata.issuer).toBe(AGENTIC);
+        expect(config.oauthMetadata.registration_endpoint).toBe(`${AGENTIC}/register`);
+        expect(config.scopesSupported).toEqual(["checkout"]);
+    });
+    it("accepts a URL carrying the well-known suffix", async () => {
+        mockDiscovery({ [PROJECT]: ["openid"], [AGENTIC]: ["checkout"] });
+        const config = await descopeProvider({
+            url: `${AGENTIC}/.well-known/openid-configuration`,
+        });
+        expect(config.oauthMetadata.issuer).toBe(AGENTIC);
+        expect(config.scopesSupported).toEqual(["checkout"]);
     });
     it("lets an explicit audience override the derived project id", async () => {
-        const issuer = "https://api.descope.com/v1/apps/agentic/P123/MS456";
-        mockDiscovery(issuer);
-        const config = await descopeProvider({ url: issuer, audience: "custom" });
+        mockDiscovery({ [PROJECT]: ["openid"], [AGENTIC]: ["checkout"] });
+        const config = await descopeProvider({ url: AGENTIC, audience: "custom" });
         expect(config.verify.audience).toBe("custom");
     });
 });

package/dist/server/auth/providers/descope.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"descope.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE;QACjD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,MAAM,GAAG,oDAAoD,CAAC;QACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtD,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,MAAM,mCAAmC,EAC5C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,oDAAoD,CAAC;QACpE,aAAa,CAAC,MAAM,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { descopeProvider } from \"./descope.js\";\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction discoveryDoc(issuer: string) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\"],\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nfunction mockDiscovery(issuer: string) {\n  return vi.spyOn(globalThis, \"fetch\").mockResolvedValue(\n    new Response(JSON.stringify(discoveryDoc(issuer)), {\n      headers: { \"content-type\": \"application/json\" },\n    }),\n  );\n}\n\ndescribe(\"descopeProvider\", () => {\n  it(\"derives issuer and audience (project id) from the MCP Server URL\", async () => {\n    const issuer = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n    const fetchSpy = mockDiscovery(issuer);\n\n    const config = await descopeProvider({ url: issuer });\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${issuer}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(config.verify.issuer).toBe(issuer);\n    expect(config.verify.audience).toBe(\"P123\");\n  });\n\n  it(\"lets an explicit audience override the derived project id\", async () => {\n    const issuer = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n    mockDiscovery(issuer);\n\n    const config = await descopeProvider({ url: issuer, audience: \"custom\" });\n\n    expect(config.verify.audience).toBe(\"custom\");\n  });\n});\n"]}
+{"version":3,"file":"descope.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,MAAc,EAAE,MAAgB;IACpD,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,MAAM;QACxB,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,sCAAsC,CAAC;AACvD,MAAM,OAAO,GAAG,oDAAoD,CAAC;AAErE,sFAAsF;AACtF,SAAS,aAAa,CAAC,IAA8B;IACnD,OAAO,EAAE;SACN,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;SAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAwB,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,MAAM,mCAAmC,CACnE,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE;YAC1D,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC7B,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;YAClD,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvD,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,OAAO,mCAAmC,EAC7C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACrD,GAAG,OAAO,WAAW,CACtB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,GAAG,EAAE,GAAG,OAAO,mCAAmC;SACnD,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { descopeProvider } from \"./descope.js\";\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction discoveryDoc(issuer: string, scopes: string[]) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: scopes,\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nconst PROJECT = \"https://api.descope.com/v1/apps/P123\";\nconst AGENTIC = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n\n// Serves each issuer its own document, so a request for one never resolves the other.\nfunction mockDiscovery(docs: Record<string, string[]>) {\n  return vi\n    .spyOn(globalThis, \"fetch\")\n    .mockImplementation(async (input: RequestInfo | URL) => {\n      const url = String(input);\n      const entry = Object.entries(docs).find(\n        ([issuer]) => url === `${issuer}/.well-known/openid-configuration`,\n      );\n      if (entry === undefined) {\n        return new Response(null, { status: 404 });\n      }\n      return new Response(JSON.stringify(discoveryDoc(...entry)), {\n        headers: { \"content-type\": \"application/json\" },\n      });\n    });\n}\n\ndescribe(\"descopeProvider\", () => {\n  it(\"accepts either issuer and advertises the agentic AS\", async () => {\n    const fetchSpy = mockDiscovery({\n      [PROJECT]: [\"openid\", \"profile\", \"email\", \"phone\"],\n      [AGENTIC]: [\"checkout\"],\n    });\n\n    const config = await descopeProvider({ url: AGENTIC });\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${PROJECT}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(config.verify.issuer).toEqual([PROJECT, AGENTIC]);\n    expect(config.verify.audience).toBe(\"P123\");\n    expect(config.oauthMetadata.issuer).toBe(AGENTIC);\n    expect(config.oauthMetadata.registration_endpoint).toBe(\n      `${AGENTIC}/register`,\n    );\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n  });\n\n  it(\"accepts a URL carrying the well-known suffix\", async () => {\n    mockDiscovery({ [PROJECT]: [\"openid\"], [AGENTIC]: [\"checkout\"] });\n\n    const config = await descopeProvider({\n      url: `${AGENTIC}/.well-known/openid-configuration`,\n    });\n\n    expect(config.oauthMetadata.issuer).toBe(AGENTIC);\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n  });\n\n  it(\"lets an explicit audience override the derived project id\", async () => {\n    mockDiscovery({ [PROJECT]: [\"openid\"], [AGENTIC]: [\"checkout\"] });\n\n    const config = await descopeProvider({ url: AGENTIC, audience: \"custom\" });\n\n    expect(config.verify.audience).toBe(\"custom\");\n  });\n});\n"]}

package/dist/server/auth/security-schemes.d.ts

@@ -11,3 +11,13 @@ export declare function evaluateSecuritySchemes(schemes: SecurityScheme[] | unde
 export declare function httpStatusForFailure(failure: SchemeFailure): 401 | 403;
 export declare function clientPrefersInBandChallenge(userAgent: string | undefined): boolean;
 export declare function wwwAuthenticateHeader(failure: SchemeFailure, resourceMetadataUrl?: string): string;
+export declare function inBandChallengeResult(failure: SchemeFailure, resourceMetadataUrl?: string): {
+    isError: boolean;
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    _meta: {
+        "mcp/www_authenticate": string[];
+    };
+};

package/dist/server/auth/security-schemes.js

@@ -1,17 +1,16 @@
+import { hostFromUserAgent } from "../host.js";
 export function authToSecuritySchemes(auth) {
-    if (auth === "public") {
-        return [{ type: "noauth" }, { type: "oauth2" }];
-    }
-    if (auth === "required") {
-        return [{ type: "oauth2" }];
-    }
-    return [{ type: "oauth2", scopes: auth.scopes }];
+    const oauth2 = {
+        type: "oauth2",
+        ...(auth.scopes?.length ? { scopes: auth.scopes } : {}),
+    };
+    return auth.allowsAnonymous ? [{ type: "noauth" }, oauth2] : [oauth2];
 }
 export function securitySchemesAllowAnonymous(schemes) {
     return !!schemes?.some((scheme) => scheme.type === "noauth");
 }
 export function evaluateSecuritySchemes(schemes, authInfo) {
-    if (securitySchemesAllowAnonymous(schemes)) {
+    if (securitySchemesAllowAnonymous(schemes) && !authInfo) {
         return undefined;
     }
     const oauth2 = (schemes ?? []).filter((scheme) => scheme.type === "oauth2");
@@ -39,8 +38,7 @@ export function httpStatusForFailure(failure) {
     return failure.error === "insufficient_scope" ? 403 : 401;
 }
 export function clientPrefersInBandChallenge(userAgent) {
-    const ua = (userAgent ?? "").toLowerCase();
-    return ua.includes("openai") || ua.includes("chatgpt");
+    return hostFromUserAgent(userAgent) === "openai";
 }
 export function wwwAuthenticateHeader(failure, resourceMetadataUrl) {
     let header = `Bearer error="${failure.error}", error_description="${failure.description}"`;
@@ -52,4 +50,15 @@ export function wwwAuthenticateHeader(failure, resourceMetadataUrl) {
     }
     return header;
 }
+export function inBandChallengeResult(failure, resourceMetadataUrl) {
+    return {
+        isError: true,
+        content: [{ type: "text", text: failure.description }],
+        _meta: {
+            "mcp/www_authenticate": [
+                wwwAuthenticateHeader(failure, resourceMetadataUrl),
+            ],
+        },
+    };
+}
 //# sourceMappingURL=security-schemes.js.map

package/dist/server/auth/security-schemes.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-schemes.js","sourceRoot":"","sources":["../../../src/server/auth/security-schemes.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,qBAAqB,CAAC,IAAc;IAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAqC;IAErC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAQD,MAAM,UAAU,uBAAuB,CACrC,OAAqC,EACrC,QAA8B;IAE9B,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,2BAA2B;YACxC,MAAM;SACP,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;IACF,OAAO,SAAS;QACd,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,uCAAuC;YACpD,MAAM;SACP,CAAC;AACR,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,OAAO,OAAO,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,SAA6B;IAE7B,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAsB,EACtB,mBAA4B;IAE5B,IAAI,MAAM,GAAG,iBAAiB,OAAO,CAAC,KAAK,yBAAyB,OAAO,CAAC,WAAW,GAAG,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpD,CAAC;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,IAAI,wBAAwB,mBAAmB,GAAG,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { AuthInfo } from \"../auth.js\";\nimport type { SecurityScheme, ToolAuth } from \"../server.js\";\n\nexport function authToSecuritySchemes(auth: ToolAuth): SecurityScheme[] {\n  if (auth === \"public\") {\n    return [{ type: \"noauth\" }, { type: \"oauth2\" }];\n  }\n  if (auth === \"required\") {\n    return [{ type: \"oauth2\" }];\n  }\n  return [{ type: \"oauth2\", scopes: auth.scopes }];\n}\n\nexport function securitySchemesAllowAnonymous(\n  schemes: SecurityScheme[] | undefined,\n): boolean {\n  return !!schemes?.some((scheme) => scheme.type === \"noauth\");\n}\n\nexport type SchemeFailure = {\n  error: \"invalid_token\" | \"insufficient_scope\";\n  description: string;\n  scopes: string[];\n};\n\nexport function evaluateSecuritySchemes(\n  schemes: SecurityScheme[] | undefined,\n  authInfo: AuthInfo | undefined,\n): SchemeFailure | undefined {\n  if (securitySchemesAllowAnonymous(schemes)) {\n    return undefined;\n  }\n  const oauth2 = (schemes ?? []).filter((scheme) => scheme.type === \"oauth2\");\n  const required = oauth2.length ? oauth2 : [{ type: \"oauth2\" as const }];\n  const scopes = [\n    ...new Set(required.flatMap((scheme) => scheme.scopes ?? [])),\n  ];\n  if (!authInfo) {\n    return {\n      error: \"invalid_token\",\n      description: \"Sign in to use this tool.\",\n      scopes,\n    };\n  }\n  const satisfied = required.some((scheme) =>\n    (scheme.scopes ?? []).every((scope) => authInfo.scopes.includes(scope)),\n  );\n  return satisfied\n    ? undefined\n    : {\n        error: \"insufficient_scope\",\n        description: \"Missing required scope for this tool.\",\n        scopes,\n      };\n}\n\nexport function httpStatusForFailure(failure: SchemeFailure): 401 | 403 {\n  return failure.error === \"insufficient_scope\" ? 403 : 401;\n}\n\nexport function clientPrefersInBandChallenge(\n  userAgent: string | undefined,\n): boolean {\n  const ua = (userAgent ?? \"\").toLowerCase();\n  return ua.includes(\"openai\") || ua.includes(\"chatgpt\");\n}\n\nexport function wwwAuthenticateHeader(\n  failure: SchemeFailure,\n  resourceMetadataUrl?: string,\n): string {\n  let header = `Bearer error=\"${failure.error}\", error_description=\"${failure.description}\"`;\n  if (failure.scopes.length) {\n    header += `, scope=\"${failure.scopes.join(\" \")}\"`;\n  }\n  if (resourceMetadataUrl) {\n    header += `, resource_metadata=\"${resourceMetadataUrl}\"`;\n  }\n  return header;\n}\n"]}
+{"version":3,"file":"security-schemes.js","sourceRoot":"","sources":["../../../src/server/auth/security-schemes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,MAAM,UAAU,qBAAqB,CAAC,IAAc;IAClD,MAAM,MAAM,GAAmB;QAC7B,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;IACF,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAqC;IAErC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAQD,MAAM,UAAU,uBAAuB,CACrC,OAAqC,EACrC,QAA8B;IAE9B,IAAI,6BAA6B,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,2BAA2B;YACxC,MAAM;SACP,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;IACF,OAAO,SAAS;QACd,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,uCAAuC;YACpD,MAAM;SACP,CAAC;AACR,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,OAAO,OAAO,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,SAA6B;IAE7B,OAAO,iBAAiB,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAsB,EACtB,mBAA4B;IAE5B,IAAI,MAAM,GAAG,iBAAiB,OAAO,CAAC,KAAK,yBAAyB,OAAO,CAAC,WAAW,GAAG,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpD,CAAC;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,IAAI,wBAAwB,mBAAmB,GAAG,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAsB,EACtB,mBAA4B;IAE5B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/D,KAAK,EAAE;YACL,sBAAsB,EAAE;gBACtB,qBAAqB,CAAC,OAAO,EAAE,mBAAmB,CAAC;aACpD;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AuthInfo } from \"../auth.js\";\nimport { hostFromUserAgent } from \"../host.js\";\nimport type { SecurityScheme, ToolAuth } from \"../server.js\";\n\nexport function authToSecuritySchemes(auth: ToolAuth): SecurityScheme[] {\n  const oauth2: SecurityScheme = {\n    type: \"oauth2\",\n    ...(auth.scopes?.length ? { scopes: auth.scopes } : {}),\n  };\n  return auth.allowsAnonymous ? [{ type: \"noauth\" }, oauth2] : [oauth2];\n}\n\nexport function securitySchemesAllowAnonymous(\n  schemes: SecurityScheme[] | undefined,\n): boolean {\n  return !!schemes?.some((scheme) => scheme.type === \"noauth\");\n}\n\nexport type SchemeFailure = {\n  error: \"invalid_token\" | \"insufficient_scope\";\n  description: string;\n  scopes: string[];\n};\n\nexport function evaluateSecuritySchemes(\n  schemes: SecurityScheme[] | undefined,\n  authInfo: AuthInfo | undefined,\n): SchemeFailure | undefined {\n  if (securitySchemesAllowAnonymous(schemes) && !authInfo) {\n    return undefined;\n  }\n  const oauth2 = (schemes ?? []).filter((scheme) => scheme.type === \"oauth2\");\n  const required = oauth2.length ? oauth2 : [{ type: \"oauth2\" as const }];\n  const scopes = [\n    ...new Set(required.flatMap((scheme) => scheme.scopes ?? [])),\n  ];\n  if (!authInfo) {\n    return {\n      error: \"invalid_token\",\n      description: \"Sign in to use this tool.\",\n      scopes,\n    };\n  }\n  const satisfied = required.some((scheme) =>\n    (scheme.scopes ?? []).every((scope) => authInfo.scopes.includes(scope)),\n  );\n  return satisfied\n    ? undefined\n    : {\n        error: \"insufficient_scope\",\n        description: \"Missing required scope for this tool.\",\n        scopes,\n      };\n}\n\nexport function httpStatusForFailure(failure: SchemeFailure): 401 | 403 {\n  return failure.error === \"insufficient_scope\" ? 403 : 401;\n}\n\nexport function clientPrefersInBandChallenge(\n  userAgent: string | undefined,\n): boolean {\n  return hostFromUserAgent(userAgent) === \"openai\";\n}\n\nexport function wwwAuthenticateHeader(\n  failure: SchemeFailure,\n  resourceMetadataUrl?: string,\n): string {\n  let header = `Bearer error=\"${failure.error}\", error_description=\"${failure.description}\"`;\n  if (failure.scopes.length) {\n    header += `, scope=\"${failure.scopes.join(\" \")}\"`;\n  }\n  if (resourceMetadataUrl) {\n    header += `, resource_metadata=\"${resourceMetadataUrl}\"`;\n  }\n  return header;\n}\n\nexport function inBandChallengeResult(\n  failure: SchemeFailure,\n  resourceMetadataUrl?: string,\n) {\n  return {\n    isError: true,\n    content: [{ type: \"text\" as const, text: failure.description }],\n    _meta: {\n      \"mcp/www_authenticate\": [\n        wwwAuthenticateHeader(failure, resourceMetadataUrl),\n      ],\n    },\n  };\n}\n"]}

package/dist/server/auth/security-schemes.test.js

@@ -9,15 +9,16 @@ describe("clientPrefersInBandChallenge", () => {
     });
 });
 describe("authToSecuritySchemes", () => {
-    it("maps the three auth shorthands", () => {
-        expect(authToSecuritySchemes("public")).toEqual([
+    it("maps the auth shorthand", () => {
+        expect(authToSecuritySchemes({ allowsAnonymous: true })).toEqual([
             { type: "noauth" },
             { type: "oauth2" },
         ]);
-        expect(authToSecuritySchemes("required")).toEqual([{ type: "oauth2" }]);
+        expect(authToSecuritySchemes({})).toEqual([{ type: "oauth2" }]);
         expect(authToSecuritySchemes({ scopes: ["checkout"] })).toEqual([
             { type: "oauth2", scopes: ["checkout"] },
         ]);
+        expect(authToSecuritySchemes({ allowsAnonymous: true, scopes: ["checkout"] })).toEqual([{ type: "noauth" }, { type: "oauth2", scopes: ["checkout"] }]);
     });
 });
 const authInfo = (scopes) => ({
@@ -38,6 +39,15 @@ describe("evaluateSecuritySchemes", () => {
         const schemes = [{ type: "noauth" }, { type: "oauth2" }];
         expect(evaluateSecuritySchemes(schemes, undefined)).toBeUndefined();
     });
+    it("enforces oauth2 scopes on a public tool once a token is present", () => {
+        const schemes = [
+            { type: "noauth" },
+            { type: "oauth2", scopes: ["checkout"] },
+        ];
+        expect(evaluateSecuritySchemes(schemes, undefined)).toBeUndefined();
+        expect(evaluateSecuritySchemes(schemes, authInfo(["openid"]))?.error).toBe("insufficient_scope");
+        expect(evaluateSecuritySchemes(schemes, authInfo(["checkout"]))).toBeUndefined();
+    });
     it("fails an oauth2-only tool with no token (invalid_token / 401)", () => {
         expect(evaluateSecuritySchemes([{ type: "oauth2" }], undefined)?.error).toBe("invalid_token");
     });